System 06 · October 2026
Agentic pipeline
A signed intent queue, a runner that only executes what it can verify, and headless agents with scoped tools. Audited by 49 agents, fixed, and verified end to end.
Measured results
- Unsigned intents executed 0 ever A hand-written JSON dropped into the queue is quarantined within a second, logged with the reason, and recorded as an error run with nothing executed.
- Audit 57 → 39 findings confirmed 49 reader agents and independent skeptics over eight subsystems; one critical and five high findings, all closed: ACLs locked, token rotated and removed from scripts, double execution fixed, no bypass anywhere.
- Verified run 8 of 9 sources pulled The first signed metrics pull after the fixes: exit 0, 14 new rows in the metrics table, a dashboard written. The ninth source was a stale export, flagged as such.
- Secret never set 10 weeks closed The honest finding of the verification: the signing secret had not been set since the gate landed, so the runner had executed nothing for ten weeks and logged a warning on every boot. Found by reading the log, not by assuming.
Problem
A runner that polls a folder and executes whatever JSON lands there is a remote-code-execution service with the owner's credentials attached. An audit of the first version found exactly that: any process that could write to the drive could trigger an unattended agent with full permissions and a live token, the same file could run two or three times, and the metrics behind the cockpit saw one job in nine.
Method
Every intent is signed with HMAC-SHA256 by one script that holds the secret; the runner verifies the signature before it reads anything else and quarantines everything it cannot verify. Agents run headless under scoped settings with an allowed-tools list, never with permissions bypassed. A singleton lock and heartbeat keep one runner alive, an in-progress set stops double execution, malformed files are retried five times and then recorded and removed. Runs write a record and a dashboard file into the vault, and the metrics puller reads every job layout rather than one.
In production
The pipeline exists so that the recurring work (pull the numbers from every job folder, write the dashboard, run the daily model radar, queue a generation from the cockpit) happens without a person at the keyboard, and so that the agents doing it cannot do anything else. The audit in June was the turning point: 49 readers over the source and the live machine state, every medium-or-higher finding re-checked by a skeptic, 57 findings, 39 confirmed real. The architecture held (lock, heartbeat, marker contracts, schema taxonomy); the trust boundary did not.
The fixes are boring on purpose. The queue folder’s inherited ACL was replaced so only the owner and the system can write to it. The token was rotated once, which made every stale copy inert, and the one script that had hard-coded it reads the environment instead. The runner verifies an HMAC before parsing, keeps an in-progress set so a file cannot run twice, and spawns agents with per-skill allowed tools. The audit note records which lines changed and keeps the original files beside the fix.
The October verification found the kind of failure that only a log can show: the signing secret had never been set, so the gate had been closed for ten weeks and nothing had run, and a second, independent fault dropped the first signed intent as a duplicate of itself. Both fixed, both re-run, both now in the log.
Next: a positive “queue auth: enabled” line at boot, and the per-skill timeouts and child reaping that matter the moment real generations route through the queue.
Captures
real time, frame counter, no speed ramps-
Four live panes, one uncut take: a hand-written JSON dropped into the queue is quarantined within a second; sign-queue-item.js enqueues a signed metrics-pull, the runner picks it up and completes it, new rows land in metrics.csv, and the run record is listed. Recorded 2026-10-15 at 3840x2088, 60 fps, wall-clock timestamp and frame counter burned in.
Claude (Anthropic) as the headless agent runtime; the runner, signer... · not in delivered pixels · real time, frame counter and timestamp